What Is Secure Boot and Should You Check for It?

What Secure Boot does

Secure Boot is a feature of the UEFI firmware that runs before the operating system. When the laptop powers on, the firmware checks the signature of the bootloader against keys stored in the firmware. If the signature is valid and trusted, the boot process continues. If not, the firmware can stop the boot and warn you.

The point is to prevent malicious or accidentally modified startup code from running. Malware that attacks the boot process is dangerous because it loads before the operating system and before most security tools. Secure Boot closes that window by establishing a chain of trust from the firmware to the bootloader.

You will see Secure Boot mentioned in firmware settings, in Windows System Information, and on Linux distribution pages. It is a specification from the UEFI Forum, and both Windows and Linux distributions can use it. A laptop that has Secure Boot is not automatically more secure in every other way, but it does remove one class of startup attacks.

Why programmers should care

For most programming work, Secure Boot is a background feature. It does not change how an editor, compiler, or terminal behaves. It becomes relevant when you install an operating system, dual boot, or work with low-level firmware tools.

Three situations matter most. First, installing Linux: many modern distributions can boot with Secure Boot enabled because they ship signed bootloaders. The exact support varies by distribution, so check the distribution's own instructions before changing firmware settings. Second, dual booting Windows and Linux: the firmware needs to trust both bootloaders, and some distributions include signed shim software to make that work. Third, Windows security features: Windows relies on the UEFI secure boot state for some protections, and security tools often report whether Secure Boot is on.

A developer who only runs Windows and uses an editor, a browser, and a local database can leave Secure Boot on and never think about it. A developer who experiments with Linux, custom kernels, or bootable USB drives should check the Secure Boot setting and understand how their chosen distribution handles it.

Windows and Linux differences

Windows 11 requires UEFI and Secure Boot capable hardware, so most new Windows laptops ship with Secure Boot enabled. On Windows you can check the status without entering the firmware: run msinfo32 and look for "Secure Boot State" in System Summary, or use PowerShell to query the firmware variable.

Linux support for Secure Boot is distribution-specific. Some distributions ship signed bootloaders and work with Secure Boot enabled. Others expect Secure Boot to be disabled, especially for proprietary drivers or custom kernels. The reliable approach is to read the distribution's installation documentation before you disable anything.

The catalogue on this site lists the operating system for each laptop but not whether Secure Boot is enabled or how the firmware behaves. That means we cannot tell you, from the specifications, how a particular laptop will handle a Linux installation with Secure Boot. What you can do is choose a laptop family that is common in your community, then check the distribution documentation and the laptop's firmware settings before installing.

Secure Boot and virtualization

If you run Docker Desktop on Windows, the installer and documentation may require you to enable virtualization in the firmware. Docker's own Windows installation guide describes enabling virtualization, and Secure Boot is often listed in the same firmware menu. The two settings are separate: virtualization allows hypervisor-based containers, while Secure Boot verifies the bootloader.

For a laptop used for containers or virtual machines, the practical advice is to check both settings when you first configure the machine. Leave Secure Boot on if your operating system supports it, and enable virtualization for Docker or other hypervisor software.

For more on the hardware side of this workflow, see the container and VM laptop guide and the RAM explainer for containers and VMs.

Checking for Secure Boot on a laptop

Before buying, you can look for Secure Boot in the product's firmware or in the manufacturer's documentation. The site's catalogue does not record Secure Boot per model, so the specification sheet alone will not tell you. After buying, checking is straightforward:

On Windows, run msinfo32 and read the Secure Boot State field. In Linux, most distributions expose the status through the efivarfs or a command like mokutil, but distribution support varies.

In the firmware setup screen, the Secure Boot option is usually under a Boot, Security, or UEFI menu. Some laptops label it as "Secure Boot", others call it "UEFI Secure Boot" or "Secure Boot Control". If you change it, the laptop may ask you to reset keys or restore factory defaults.

• Check the firmware settings screen for an Enable or Disable toggle.
• On Windows, use System Information (msinfo32) to read the Secure Boot State.
• For Linux, consult your distribution's documentation for the supported way to read the Secure Boot status.

What to pick for your work

Secure Boot is not a reason to choose a particular processor, graphics card, or amount of RAM. It is a firmware feature that comes with modern UEFI laptops. For a programmer, the buying decision is still about the specifications that affect your daily work: RAM for editors and containers, storage for repositories and virtual machines, and a screen and weight you can carry.

If you plan to run Linux as your main system, choose a laptop from a family with strong community documentation, then verify the Secure Boot behavior for your chosen distribution. If you plan to use Windows with Docker Desktop or Hyper-V, enable virtualization and leave Secure Boot on. If you only need a Windows laptop for web development or general programming, secure boot will simply be on in the background.

What to pick for your work

Questions

Is Secure Boot required for Windows 11?

Windows 11 requires UEFI and Secure Boot capable hardware, so new Windows laptops generally ship with Secure Boot enabled. On a Windows laptop you can confirm the state with msinfo32.

Does Secure Boot stop Linux from installing?

Not always. Many Linux distributions support Secure Boot by shipping signed bootloaders. Support varies by distribution, so check the distribution's installation documentation before changing firmware settings.

Should I disable Secure Boot to run Linux?

Only if your chosen distribution requires it. Start with Secure Boot enabled and follow the distribution's documentation. If the installer complains about the bootloader signature, the distribution's docs will tell you whether to disable Secure Boot or add a key.

Does Secure Boot affect Docker Desktop or virtual machines?

Secure Boot and virtualization are separate firmware features. Docker Desktop on Windows requires virtualization to be enabled. Secure Boot verifies the bootloader and can stay on.

Can I check Secure Boot without entering the BIOS?

On Windows, run msinfo32 and read the Secure Boot State field. On Linux, the method varies by distribution; check your distribution's documentation for the supported command or tool.

Is Secure Boot the same as BitLocker or disk encryption?

No. Secure Boot verifies the bootloader before the OS loads. Disk encryption protects data after the OS is running. They are complementary security features, not replacements for each other.